mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-03 08:18:52 +02:00
Originally we found physical offsets for pdbs that matched, then found potential offsets and tested them against each other. Now, we find the potential offsets and then look for pdbs at that offset (technically within a 4Mb block after the start). The scanning is quick (probably quicker than scanning the whole physical space) and should catch most pdbs unless they're splayed out in virtual memory.